二进制部署kubernetes完毕后,查看群集状态为NotReady,现在开始二进制部署calico网络
在kubelet添加cni配置
[root@k8s-master ~]# vim /usr/local/kubernetes/conf/kubelet添加:--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin
重启kubelet服务,生效。
一、部署calico
1、下载calico-etcd.yaml文件
[root@k8s-master ~]# wget https://docs.projectcalico.org/manifests/calico-etcd.yaml
2、下载镜像
[root@k8s-master ~]# cat calico-etcd.yaml | grep image:
[root@k8s-master ~]# docker pull calico/cni:v3.14.0[root@k8s-master ~]# docker pull calico/pod2daemon-flexvol:v3.14.0[root@k8s-master ~]# docker pull calico/node:v3.14.0[root@k8s-master ~]# docker pull calico/kube-controllers:v3.14.0
3、生成秘钥
[root@k8s-master ~]# cat /usr/local/kubernetes/ssl/etcd-key.pem | base64 -w 0[root@k8s-master ~]# cat /usr/local/kubernetes/ssl/etcd.pem | base64 -w 0[root@k8s-master ~]# cat /usr/local/kubernetes/ssl/ca.pem | base64 -w 0
4、修改配置文件
[root@k8s-master ~]# vim calico-etcd.yaml修改:### Secret 配置###etcd-key: (cat /usr/local/kubernetes/ssl/etcd-key.pem | base64 -w 0) # 将输出结果填写在这里etcd-cert: (cat /usr/local/kubernetes/ssl/etcd.pem | base64 -w 0) # 将输出结果填写在这里etcd-ca: (cat /usr/local/kubernetes/ssl/ca.pem | base64 -w 0) # 将输出结果填写在这里 ### ConfigMap配置###etcd_endpoints: "https://192.168.1.1:2379,https://192.168.1.2:2379,https://192.168.1.3:2379"etcd_ca: "/calico-secrets/etcd-ca"etcd_cert: "/calico-secrets/etcd-cert"etcd_key: "/calico-secrets/etcd-key" ###修改Pod使用的 IP 网段,默认是192.168.0.0/16 网段###- name: CALICO_IPV4POOL_CIDR value: "10.244.0.0/16" ###配置网卡自动发现规则,在DaemonSet calico-node env 中添加网卡发现规则#### 定义ipv4自动发现网卡规则- name: IP_AUTODETECTION_METHODvalue: "interface=ens.*"# 定义ipv6自动发现网卡规则- name: IP6_AUTODETECTION_METHOD value: "interface=ens.*" ###Calico模式设置###- name: CALICO_IPV4POOL_IPIP value: "Always"
5、创建Pod
[root@k8s-master ~]# kubectl apply -f calico-etcd.yaml
报错:
原因:Node节点无法连接API-Server服务器,API-Server服务的端口号是6443(默认是443),需要手动配置。配置如下:
在DaemonSet calico-node env 中添加环境变量:
- name: KUBERNETES_SERVICE_HOST value: "192.168.1.3" - name: KUBERNETES_SERVICE_PORT value: "6443" - name: KUBERNETES_SERVICE_PORT_HTTPS value: "6443"
6、查看Pod
[root@k8s-master ~]# kubectl get pods -n kube-system -o wide
注意:calico-kube-controllers不要运行在master接点上,解决办法:
[root@k8s-master ~]# kubectl taint nodes k8s-master key1=value1:NoSchedule
7、查看群集状态
[root@k8s-master ~]# kubectl get nodes
二、验证Calico网络
1、查看tunl0网卡接口
K8s-master:
[root@k8s-master ~]# ifconfig tunl0
[root@k8s-node-1 ~]# ifconfig tunl0
[root@k8s-node-2 ~]# ifconfig tunl0
2、创建Pod测试
(1)连通性测试
[root@k8s-master ~]# ping -c 2 10.244.109.66[root@k8s-master ~]# ping -c 2 10.244.140.66
(2)Node节点中会生成pod相关的网卡信息
K8s-node-1:
K8s-node-2:
(3)访问nginx服务
[root@k8s-master ~]# curl 192.168.1.1:31261
三、部署calicoctl
[root@k8s-master ~]# wget https://github.com/projectcalico/calicoctl/releases/download/v3.14.0/calicoctl [root@k8s-master ~]# chmod +x calicoctl[root@k8s-master ~]# cp calicoctl /usr/local/bin/ [root@k8s-master ~]# scp calicoctl 192.168.1.1:/usr/local/bin/[root@k8s-master ~]# scp calicoctl 192.168.1.2:/usr/local/bin/ [root@k8s-master ~]# calicoctl version
查看k8s-master网络状态
[root@k8s-master ~]# calicoctl node status
查看k8s-node-1网络状态
[root@k8s-node-1 ~]# calicoctl node status
查看k8s-node-2网络状态
[root@k8s-node-2 ~]# calicoctl node status
[root@k8s-master ~]# route -n
[root@k8s-master ~]# netstat -antlp | grep ESTABLISHED | grep bird
[root@k8s-node-1 ~]# netstat -antlp | grep ESTABLISHED | grep bird
[root@k8s-node-2 ~]# netstat -antlp | grep ESTABLISHED | grep bird